EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red…
Priority LOW 35Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.
Why it matters now
EPSS 0.00909 60th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | JBoss BRMS | 5 | — | No fix listed | CNA |
| Red Hat | JBoss Enterprise Application Platform | 5 | — | No fix listed | CNA |
| Red Hat | JBoss Operations Network | 3.1 | — | No fix listed | CNA |
| Red Hat | JBoss Portal | 4; 5 | — | No fix listed | CNA |
| Red Hat | JBoss SOA Platform | 4.2; 4.3; 5 | — | No fix listed | CNA |
| Red Hat | JBoss Enterprise Web Server | 1 | — | No fix listed | CNA |
- JBoss BRMS VendorRed Hat Affected 5 Fixed in — No fix listed CNA
- JBoss Enterprise Application Platform VendorRed Hat Affected 5 Fixed in — No fix listed CNA
- JBoss Operations Network VendorRed Hat Affected 3.1 Fixed in — No fix listed CNA
- JBoss Portal VendorRed Hat Affected 4; 5 Fixed in — No fix listed CNA
- JBoss SOA Platform VendorRed Hat Affected 4.2; 4.3; 5 Fixed in — No fix listed CNA
- JBoss Enterprise Web Server VendorRed Hat Affected 1 Fixed in — No fix listed CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:jboss_brms:5:*:*:*:*:*:*:* | 5 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_operations_network:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_portal:4.0.0:*:*:*:*:*:*:* | 4.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_portal:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_soa_platform:4.2:*:*:*:*:*:*:* | 4.2 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_soa_platform:4.3:*:*:*:*:*:*:* | 4.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:jboss_soa_platform:5:*:*:*:*:*:*:* | 5 | Vulnerable | Red Hat |
- cpe:2.3:a:redhat:jboss_brms:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_application_platform:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_enterprise_web_server:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_operations_network:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_portal:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_portal:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_soa_platform:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_soa_platform:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:jboss_soa_platform:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss BRMS 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat JBoss SOA Platform 5 | Affected | No fix planned: Will not fix |
Not affected: 2 products
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
Timeline
- 2026-10-02 Threatist record created from CVE-2012-5626
- 2026-10-03 Alias added: GHSA-jmm8-g2w4-4fc4
References
More Red Hat Jboss Brms vulnerabilities
- TI-2018-13721 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13720 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-13719 FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified… CVSS 3.0CRITICAL 9.8
- TI-2018-08616 An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and… CVSS 3.1HIGH 7.5
- TI-2018-08617 An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and… CVSS 3.0HIGH 7.5
- TI-2016-06052 Path traversal in Red Hat Drools Workbench CVSS 3.0MEDIUM 6.5
Sources
- CVE-2012-5626 · CVE Program
- CVE-2012-5626 · NVD
- FIRST EPSS
- GHSA-jmm8-g2w4-4fc4 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-5626 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences